We’ve all lost things at some time in our lives – car keys, wallet, mobile phone – and have experienced the frustrations this can cause.  Some might have lost things like laptops, and had to suffer the problems of paying for a replacement, and the loss of useful information that was on the device. 

These problems are irritating, but usually don’t cause much more than minor inconvenience.  If only it was the same in the business world.  That laptop loss, or loss of a USB flash drive, could be just the first of many problems.  Does the business know what data was on that PC or thumb drive?  Did the user remember to encrypt the data?  What are the ramifications if the data falls into the wrong hands?

This article from Jon Collins, head of research company Freeform Dynamics, looks at practical, good-practice steps companies can take to minimise the fallout from device losses. 

It maps closely onto the benefits our secure USB flash drives and data management solution deliver to users – automated, transparent protection of data, the ability to track and audit what data has been copied to devices, and remote device termination.  With the right equipment, small problems will stay small.

When a high-profile data loss occurs, it’s always easy for an organisation to blame an individual for breaching security policies and processes.  But is it helpful?  Does it solve the issue?  In some cases, the blame game can divert attention away from the real issue that caused the security breach – and making it more likely that it could happen again.

This is a point highlighted in this article from UK title Computer Weekly.  It references two recent cases of USB thumb drive losses that affected on the UK Government.

The first, in November 2008, was when an IT analyst from a computer management firm left a memory stick in a pub car park that had confidential pass codes to the online Government Gateway system. The memory stick was found, but passed on to the UK’s Daily Mail newspaper.  This led to the UK government temporarily closing the online Government Gateway, while it probed the breach.

The second was the loss of a thumb drive by an employee of PA Consulting.  The drive contained data on 84,000 criminals. 

Both losses were blamed on the individual and the breach of policy – but the question is, did the organisations concerned also review why the employee was able to download this data, unsecured, in the first place? 

So it’s not enough to blame an individual for the mistake.  Policies must be reviewed – and enforced by solutions, such as issuing staff with secure USB flash drives, that feature mandatory encryption.  This way, losses can be contained without blame for either staff or individuals.